Free CIS-CPG sample questions

Correct answer: Define a Resource Profile that specifies the required network security group and a Lease Profile with a 90-day duration. Then, create a Governance Policy that applies this combined Resource Profile when the 'CostCenter:Trading' tag is present.

This is the most efficient and declarative approach. CPG is designed to handle such requirements through the combination of Resource Profiles (for resource attributes like network settings) and Policies (for conditional enforcement based on metadata like tags). A policy can enforce the application of a specific profile, which in turn defines the technical specifications and lease terms, avoiding the need for complex custom scripting.

Correct answer: Cloud Operation Context

The Cloud Operation Context is a data structure that persists throughout a CAPI workflow's execution. It acts as a data bus, allowing one activity (e.g., provisioning the database) to write output variables (like the IP address) into the context, which can then be read by subsequent activities (e.g., configuring the web server).

Correct answers: Tenant ID; Application (client) ID; Client Secret or Certificate

To authenticate an Azure Service Principal, you need the Tenant ID (to identify the Azure AD directory), the Application (client) ID (to identify the application registration), and a Client Secret or Certificate (as the password/proof of identity).

Correct answer: Configure the Terraform Connector, point it to the Git repository containing the Terraform configuration, generate a Cloud Catalog Item from the template, and then publish it.

The standard and recommended process involves connecting ServiceNow to the source of the Terraform configuration (like a Git repo) via the Terraform Connector. ServiceNow can then parse the template, generate a corresponding Catalog Item with variables mapped as inputs, and make it available for provisioning, leveraging the native integration.

Correct answer: False

A Resource Profile is provider-specific. You would create one Resource Profile for AWS settings (e.g., specifying an EC2 instance type) and a separate Resource Profile for Azure settings (e.g., specifying an Azure VM size). A policy could then be used to select the appropriate profile based on the target cloud provider.

Correct answer: The Blueprint Container configuration

The Blueprint is the central component that maps user inputs from the Cloud Catalog Item to the parameters of the underlying infrastructure template (like an ARM template). An incorrect mapping or data type mismatch in the Blueprint configuration is a common cause of 'InvalidTemplate' errors, as it results in malformed data being sent to the cloud provider's API.

Correct answer: As attributes in the top-level Resource Block in the blueprint hierarchy.

Defining tags at the top-level Resource Block (often the Stack or Blueprint Container) ensures that they are inherited by all child resources within the provisioned stack. This is the most efficient and scalable method for applying universal tags, as it centralizes the logic and avoids having to repeat the tag definitions in every catalog item or policy.

Correct answer: Permissions on the Cloud Accounts for access control, a Quota policy with an approval rule for the cost limit, and ensuring the 'Create CI' flag is enabled on the Resource Blocks.

This combination correctly addresses all four requirements using native CPG features: 1) Permissions applied directly to the Cloud Accounts restrict which users/groups can provision into them. 2 & 3) A Quota policy is the correct tool for setting a spending limit and can be configured to trigger an approval workflow when the threshold is breached. 4) The 'Create CI' flag on Resource Blocks is the standard mechanism that instructs CPG to create a corresponding Configuration Item (CI) in the CMDB upon successful provisioning.

Correct answer: To parse the JSON or XML response from a cloud provider's API call and extract specific values.

The Response Processor is executed after CAPI receives a response from a cloud provider's API. Its main purpose is to parse this response (typically in JSON format), extract key information (like a resource ID, IP address, or status), and map it to variables in the Cloud Operation Context for use in subsequent workflow steps.

Correct answer: Compute Profile

A Compute Profile is a type of Resource Profile specifically designed to define virtual hardware specifications. It allows administrators to create named, pre-defined configurations (t-shirt sizes) for CPU, memory, and other compute resources, which can then be presented as simple choices to end-users in the Cloud Catalog.